From: Pascal Hambourg <pascal@plouf.fr.eu.org>
To: neal.p.murphy@alum.wpi.edu
Cc: netfilter@vger.kernel.org
Subject: Re: iptables DNAT algorithm -- another way?
Date: Sat, 13 Dec 2014 10:21:04 +0100 [thread overview]
Message-ID: <548C0500.8030408@plouf.fr.eu.org> (raw)
In-Reply-To: <201412121950.59768.neal.p.murphy@alum.wpi.edu>
Hello,
Neal Murphy a écrit :
> On Friday, December 12, 2014 06:55:21 PM John Miller wrote:
>>
>> My solution thus far has been to use DNAT to trick our scanning program
>> into thinking it's using local addresses.
>>
>> iptables -t nat -A OUTPUT -d 172.16.x.y -j DNAT \
>> --to-destination 129.64.x.y
>
> This might point you in the right direction:
>
> iptables -t nat -A PREROUTING -s 172.16.0.0/16 \
> -j DNAT --to-destination 129.64.0.0-129.64.255.255
>
> But I don't know if it provides predictable 1:1 mapping.
It doesn't. You want to use NETMAP instead of DNAT.
> Traditionally, DNAT must be done in the nat table in PREROUTING (change the
> destination address before any routing decisions are made).
That's for incoming packets. For locally-generated outgoing packets, you
want to use the OUTPUT chain.
next prev parent reply other threads:[~2014-12-13 9:21 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-12-12 23:55 iptables DNAT algorithm -- another way? John Miller
2014-12-13 0:50 ` Neal Murphy
2014-12-13 1:06 ` John Miller
2014-12-13 1:26 ` Neal Murphy
2014-12-13 9:21 ` Pascal Hambourg [this message]
2014-12-13 19:52 ` John Miller
2014-12-13 21:30 ` Pascal Hambourg
2014-12-14 3:30 ` John Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=548C0500.8030408@plouf.fr.eu.org \
--to=pascal@plouf.fr.eu.org \
--cc=neal.p.murphy@alum.wpi.edu \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox